CVE-2026-40404: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability

Synopsis

This is an elevation-of-privilege vulnerability in the Windows Universal Disk Format File System Driver (UDFS), a kernel-mode component present in Windows 10 and Windows 11. The vulnerability is reachable locally, meaning an attacker already has a low-privilege shell or process on the target host, and no additional authentication beyond that existing account is required. Successful exploitation gives the attacker full control over the host, reading arbitrary files, writing or corrupting data, and crashing or taking over services. Patched-image rebuilds at the applicable fix versions are available on HarborGuard for environments running affected Windows-based container images.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed before exploitation.

• Victim interactionNot required

  No action from another user or victim is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and imposes no special environmental conditions or timing requirements.

Blast Radius

• Reads arbitrary files on the host, including credentials, certificates, and sensitive application data stored on disk.
• Writes or modifies files and system data, allowing the attacker to plant backdoors or corrupt application state.
• Crashes or takes over system services, causing denial of service or enabling further lateral movement within the host.
• Achieves full kernel-level control of the affected Windows host, removing all OS-enforced access boundaries.